To report a vulnerability, please open a private vulnerability report by GitHub's private vulnerability reporting feature.
Repository navigation
Security: voidzero-dev/vite-plus
Security
SECURITY.md
-
Shell Command Injection via an Unvalidated Registry Version StringGHSA-p79r-mf8q-r78h published
Nov 9, 2026 by fengmk2High -
Code Execution via an Unverified Package Manager Download from a Repository-Named RegistryGHSA-5qr3-w62x-jmwx published
Nov 9, 2026 by fengmk2High -
Path traversal in `vite-plus/binding` `downloadPackageManager()` writes outside `VP_HOME`GHSA-33r3-4whc-44c2 published
Apr 15, 2026 by fengmk2Moderate
Learn more about advisories related to voidzero-dev/vite-plus in the GitHub Advisory Database